CVE-2004-2061

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 27, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-20627.5SQL injection vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to execute arbitrary SQL via the (1) thrCVE-2004-20634.3Cross-site scripting (XSS) vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to inject arbitrary HTML orCVE-2004-20644.3Cross-site scripting (XSS) vulnerability in lostBook 1.1 and earlier allows remote attackers to inject arbitrary web script via the (1) EmaiCVE-2004-20657.5DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filenameCVE-2004-20667.5SQL injection vulnerability in session.php in LinPHA 0.9.4 allows remote attackers to execute arbitrary SQL code and bypass authentication vCVE-2004-20677.5SQL injection vulnerability in controlpanel.php in Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbitCVE-2004-20685.0fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article CVE-2004-20695.0sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileCVE-2004-20707.2The Altiris Client Service for Windows 5.6 SP1 Hotfix E (5.6.181) allows local users to execute arbitrary commands by opening the AClient trCVE-2004-20717.5Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier versions, allows remote attackers to bypass authentication in the web interCVE-2004-20726.8Cross-site scripting (XSS) vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions, allows remote attackers to eCVE-2004-20737.2Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server v
CVE-2004-2061: Critical severity, CVSS 9.8 | Vulnix